TODO MASTER ME only send XSRF token when logged in